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SENSITIVE 

STATE  FOR  EUR/WE,  EB/TRA,  S/CT;  DHS  FOR  TSA  AND  CBP 

E.O.  12958:  N/A 
TAGS:  EAIR  PTER  FR 

SUBJECT:  FRANCE:  TSA  BRIEFS  DATA  PRIVACY  AUTHORITY  ON 
AVIATION  SECURITY  ARRANGMENTS 


1.1.  (SBU)  Summary:  TSA  provided  an  extensive  briefing  on  U.S. 
aviation  security  arrangements  to  the  French  Data  Privacy 
Authority  (CNIL)  in  a meeting  January  12.  Because  of  the 
current  risk  that  the  CNIL  may  wish  to  review  all  U.S. 
airlines 1 aviation  security  practices  regarding 
implementation  of  the  no-fly  and  selectee  watch  lists  for 
conformity  with  French  data  privacy  law,  the  briefing  was  an 
excellent  opportunity  to  respond  to  concerns  that  go  beyond 
the  specific  case  being  considered  by  the  CNIL. 

12.  (SBU)  TSA  Assistant  Chief  Counsel  for  International  Law 

Anthony  Giovanniello  briefed  the  CNIL  in  connection  with 
their  investigation  of  Continental  Airlines'  (CA)  actions 
relating  to  the  transportation  of  Vincent  Flecheux,  a French 
National  who  was  refused  entry  to  the  U.S.  by  CBP  in  Houston 
August  13,  and  who  in  a complaint  filed  with  the  CNIL  claimed 
that  CA  personnel  had  told  him  this  was  in  connection  with 
his  presence  on  the  No-Fly  list.  In  previous  meetings,  CA 

had  found  it  impossible  to  answer  many  of  the  CNIL 1 s 

questions  due  to  their  inclusion  of  Sensitive  Security 
Information  (SSI),  which  they  are  prevented  from  disclosing 
to  parties  without  a need  to  know. 

1.3.  (SBU)  Explaining  the  definition  and  reasoning  behind  SSI, 
Giovanniello  stated  that  he  had  specifically  obtained 
permission  to  discuss  a number  of  aspects  of  the  aviation 
passener  pre-sceening  process  with  the  CNIL  in  the  hopes  that 
it  would  clarify  issues  raised  by  the  case,  and  put  to  rest 
suspicions  that  it  was  somehow  related  to  No-Fly  or  Selectee 
screening,  rather  than  the  obligation  of  CBP  to  refuse  entry 
to  travelers  it  determined  were  ineligible  for  admission  to 
the  U.S.  He  emphasized  that  he  would  be  unable  to  provide 
further  details  about  the  specific  case,  as  it  was  TSA  policy 


neither  to  confirm  or  deny  subject's  inclusion  on  watchlists. 

He  could  affirm  however  that  CBP ' s decision  was  not  related 
to  aviation  security:  border  protection  was  a separate  legal 
and  law  enforcement  issue.  CBP  maintained  its  own  immigration 
watch  lists,  which  contained  names  with  no  relation  to 
aviation  security — e.g.  child  abduction  suspects.  CNIL 
Commissioner  de  la  Loyere  indicated  that  he  clearly 
understood  the  distinction  between  border  control  and 
aviation  security. 

14.  (SBU)  Giovanniello  began  by  describing  the  architecture  of 
the  aviation  security  arrangements  created  after  2003.  TSA 
administered  the  No  Fly  and  Selectee  lists,  which  were 
created  by  the  Terrorist  Screening  Center  (TSC)  working  with 
various  nominating  agencies.  It  determined  who  met  the 
criteria  for  inclusion,  broadly  speaking  either  representing 

a threat  to  aviation  or  a threat  of  terrorism.  No-Fly  listees 
could  not  board  U.S. -bound  aircraft,  while  selectees  required 
additional  screening  before  continuing  their  travel.  These 
lists  were  furnished  to  airlines,  which  were  required  to 
notify  the  USG  of  exact  or  close  matches,  which  were  then 
evaluated  by  TSC  and  double-checked  through  consultation  with 
the  originating  agency  if  the  match  was  positive.  In 
response  to  a question  about  No-Fly  diversions,  Giovanniello 
explained  that  these  decisions  were  made  at  a very  high  level 
in  DHS,  and  only  after  thorough  review  led  to  a conclusion 
that  a threat  existed,  in  accordance  with  our  rights  under 
the  Chicago  Convention. 

15.  (SBU)  The  CNIL  was  interested  in  how  CA  applied  some  of 
these  directives,  and  asked  in  particular  about  an  orange 
sticker  the  security  contractor  applied  to  the  passenger's 
passport,  and  any  requirements  for  eventual  notification  of 
the  French  authorities  in  case  of  a positive  match. 
Giovanniello  replied  that  neither  of  these  was  required  by 
U.S.  security  directives;  CA  counsel  confirmed  that  its 
security  contractor  used  the  sticker  as  an  aid  to  flag 
candidates  for  additional  security  screening,  either  because 
they  were  Selectees  or  had  been  chosen  at  random  to  meet 
French  selectee  screening  requirements.  CA  notified  the 
French  border  police  immediately  of  any  security  risks 
encountered  in  screening. 

1.6.  (SBU)  The  CNIL  also  inquired  about  security  measures  taken 
to  protect  the  lists  from  piracy  during  transmission;  they 
had  heard  these  did  not  include  encryption.  TSA  confirmed 
that  lists  were  not  only  protected  by  encryption  in  both 
directions,  but  by  background  checks  and  legal  sanctions  over 
divulging  SSI  among  personnel  with  access  to  them. 

Giovanniello  said  that  under  the  APIS  Quick  Query  (AQQ)  and 
Secure  Flight  initiatives  TSA  would  at  some  point  be  expected 
to  entirely  take  over  the  responsibility  for  matching  names, 
making  transmission  of  the  lists  unnecessary.  In  response  to 
another  question,  TSA  noted  that  airlines  were  required  to 
maintain  lists  and  records  of  hits  for  only  60  days,  in  case 
follow-up  investigation  was  needed.  According  to  CA,  no  list 
of  secondary  screenees  was  maintained  by  their  security 
contractor . 

1.7 . (SBU)  Commissioner  de  la  Loyere  noted  that  the  CNIL  was 
particularly  concerned  about  watchlists'  inclusion  of 
innocent  passengers.  How  did  passengers  who  were  wrongly 
listed  get  off  our  watchlists?  TSA  explained  the  redress 
process,  which  the  CNIL  was  familiar  with  from  a letter 
Flecheux  had  received  from  the  TSA  ombudsman  clearing  him  for 
travel.  TSA  also  explained  how  travel  is  facilitated  by 
adding  a "cleared"  entry  to  watchlists  to  prevent  legitimate 
travelers  with  exact  or  close  name  matches  to  watchlist 
entries  from  being  mistakenly  identified  with  them.  TSA 
described  an  upcoming  modification  of  the  redress  process 
(DHS  Traveler  Redress  Inquiry  System),  by  which  it  would 
serve  as  a one-stop  shop  for  watchlist  redress  requests, 
coordinating  across  the  various  agencies  of  DHS  and 
facilitating  the  travel  of  legitimate  passengers. 

18.  (SBU)  The  CNIL  concluded  by  indicating  it  would  be 
continuing  its  enquiries  into  the  Flecheux  case,  as  it  still 
had  not  received  responses  from  some  French  government 


agencies . 


f.9 . (SBU)  Participants  for  the  CNIL  included  Commissioner 
Georges  de  la  Loyere,  General  Secretary  Yann  Padova,  Sophie 
Vuillet-Tavernier , Director  of  Legal  Affairs,  and  Pascale 
Raulin-Serrier  of  the  European  and  International  Affairs 
Division.  Continental  Airlines  was  represented  by  Amy  Bried, 
Senior  Attorney,  and  Isabelle  Gavadon,  Partner  in  the  Paris 
law  firm  FIDAL.  USG  attendees  were  Anthony  Giovanniello,  TSA 
Assistant  Chief  Counsel  for  International  Law,  Embassy  Paris 
TSA  Representative,  and  Econoff.  Assistant  Chief  Counsel 
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Giovanniello  cleared  this  cable. 

11_10.  (SBU)  Comment:  This  meeting  proved  to  be  a good 
opportunity  to  address  a number  of  concerns  raised  by  the 
CNIL.  USG  participation  was  much  appreciated  by  Continental 
Airlines,  and  we  hope  the  forthright  description  of  our 
aviation  security  practices — including  processes  for 
protection  of  data,  review  of  listings  and  redress  in  case  of 
error — will  encourage  the  CNIL  to  await  implementation  of  AQQ 
and  Secure  Flight  before  undertaking  any  extensive  review  of 
airlines  security  screening  practices,  if  at  that  point  they 
still  deem  it  necessary. 
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